chore(deps): Bump xunit from 2.6.2 to 2.9.3#14
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
force-pushed
the
dependabot/nuget/IronBase.NET/src/IronBase.Tests/xunit-2.9.3
branch
from
0a0e333 to
67d345c
Compare
--- updated-dependencies: - dependency-name: xunit dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/nuget/IronBase.NET/src/IronBase.Tests/xunit-2.9.3
branch
from
67d345c to
0134755
Compare
petitan
added a commit
that referenced
this pull request
Dec 21, 2025
CRITICAL: - BUG #1: Transaction commit/rollback now uses write lock (was read lock - race condition) - BUG #2: max_operations=0 now uses default limit (was unlimited - DoS vulnerability) - BUG #3: switch_database acquires write lock before existence check (TOCTOU fix) - BUG #4: API key serialization uses ? instead of unwrap (was panic risk) HIGH: - BUG #5: Script versioning uses optimistic locking with version check (race condition fix) - BUG #6: API key cache logs errors instead of silent ignore - BUG #7: Script delete checks for dependent scripts before deletion - BUG #8: TLS key file read once into memory, no double-open - BUG #9: Collection flags update uses write lock (was read lock) MEDIUM: - BUG #10: Projection validation checks values before truncating cast - BUG #12: Script name validation added (same rules as collection names) - BUG #13: Directory creation failures logged instead of silent ignore - BUG #14: All unwrap/expect calls replaced with proper error handling NOT A BUG: - BUG #11: parking_lot::Mutex doesn't poison (verified) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan
added a commit
that referenced
this pull request
Dec 26, 2025
Security fixes: - #13: HTTP header case-insensitivity - Authorization header now accepts both "Bearer" and "bearer" prefix, with fallback to lowercase header name - #14: tools/list info leak - admin_* tools now hidden from non-localhost callers to prevent information disclosure about admin capabilities - #3: ACL TOCTOU documentation - added security comments explaining the minimal TOCTOU window in current architecture Implementation details: - Added get_tools_list_filtered(is_localhost: bool) function in tools.rs - Updated http_server.rs to detect localhost and filter tools accordingly - Case-insensitive Bearer token extraction in extract_api_key() All 141 tests passing (75 unit + 66 integration). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
petitan
added a commit
that referenced
this pull request
Apr 18, 2026
…rst write order Root cause: update_one_prepare held storage.write() for the entire document search (O(N) catalog scan on 191K docs = ~35s), blocking all concurrent writes including periodic checkpoint. Fix (two parts): 1. Two-phase lock splitting (like delete_one_prepare): - Phase 1: find matching doc_id via query planner (storage.read()) - Phase 2: re-read + modify + write under storage.write() (brief) Result: update_one 35s → 230ms (150×), upsert 38s → 370ms (100×) 2. Storage-first write order (code-stasi AKTA #1): - OLD: index update → validate → storage write (index corrupt on write failure) - NEW: validate → storage write → index update (indexes consistent on failure) Storage is source of truth; indexes rebuilt from storage on restart. Additional fixes from code-stasi review: - Document::from_value() instead of from_json(to_string()) roundtrip (#4) - use_cache=false since limit=1 bypasses cache anyway (#14) - Move semantics instead of clone for old_doc_value (#8) - Fixed misleading comment about O(1) _id fast path (#3) - Documented why tombstone uses write_data vs write_document_raw (#6) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
petitan
added a commit
that referenced
this pull request
Apr 21, 2026
flush() appends data sections (doc_tokens, token entries, token_offsets, metadata) to the existing .ftidx file and then rewrites the header to point at the new offsets, with a single sync_all at the very end. The kernel is free to reorder page flushes, so a crash between the header being persisted and the final sync could leave the file with a header pointing at un-persisted bytes. On reopen the header still passes magic+version checks and loads "successfully" with garbage. Adds an fsync between the payload writes and the header rewrite (same pattern as PR 1's write_metadata_and_header fix), so the header can only reach disk after the data it points at is already durable. Part 1/2 for single-phase atomic flush; Commit 2 will do the same for serialize_flush (two-phase checkpoint path). Related: #14 Phase A1 — crash-safety for non-btree index files. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
petitan
added a commit
that referenced
this pull request
Apr 21, 2026
serialize_flush is Phase 2 of the two-phase checkpoint flush: writes doc_tokens offsets, token entries, token_offsets, metadata, then rewrites the header with new section offsets, and finishes with a single sync_all. Same kernel page-flush reordering risk as flush() — crash between header persistence and final fsync leaves a header pointing at un-persisted bytes. Adds the write barrier between payload and header rewrite. Mirrors commit 7ea9396 for single-phase flush(). Part 2/2 for single-phase atomic flush in fulltext #14 Phase A1. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
petitan
added a commit
that referenced
this pull request
Apr 21, 2026
Both flush_vector_indexes (all dirty) and flush_one_vector_index (single)
wrote the HNSW cache via File::create on the destination path, buffered
write, buffer flush, then mark_clean — with no fsync at all. A crash
mid-write produced a torn .hnsw that load_from would deserialize
"successfully" (no magic/CRC check on the format) with garbage.
Extracts a shared persist_hnsw_to_file helper that writes to
{path}.hnsw.tmp, fsyncs the temp file, then uses
fs_utils::atomic_rename_and_sync for the atomic swap + POSIX parent-dir
fsync. Matches the pattern already in wal/writer.rs and
index/fuzzy.rs (PR 3).
Startup cleanup extended in storage::mod::open to also remove orphan
.hnsw.tmp files, alongside the existing .idx.tmp / .fzidx.tmp handling.
Related: #14 Phase A2 — crash-safety for non-btree index files.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/nuget/IronBase.NET/src/IronBase.Tests/xunit-2.9.3
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated xunit from 2.6.2 to 2.9.3.
Release notes
Sourced from xunit's releases.
No release notes found for this version range.
Commits viewable in compare view.
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)